News for hackers. Stuff that matters.

A comment on Switch to VPC Endpoints from Nat Gateways to Reduce Bandwidth Charges. Parent comment

Re:Switch to VPC Endpoints from Nat Gateways to Reduce Bandw... by sigstoat on Saturday June 18, 2022 @11:48PM (#31795992)
> you end up having to open network traffic to all of a particular aws service, not just yours

> I could exfil data to those aws services

I don't think any of the VPC endpoints have any restrictions on them; that is, once I've made an S3 endpoint in my VPC, it can be used to access any bucket. So... it seems like it could be used just as easily to exfiltrate data?

[ Parent | on HN ]
Re:Switch to VPC Endpoints from Nat Gateways to Reduce Bandw... by cldellow on Sunday June 19, 2022 @12:12AM (#31796103)
I haven't done it, but the docs seem to imply that some VPC endpoints, including S3, can support the usual policy documents to describe which actions/principals/resources are permitted: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
[ Parent | on HN ]
Re:Switch to VPC Endpoints from Nat Gateways to Reduce Bandw... by different_sort on Sunday June 19, 2022 @10:12AM (#31799552)
That is indeed the case.
[ Parent | on HN ]
Re:Switch to VPC Endpoints from Nat Gateways to Reduce Bandw... by Galanwe on Sunday June 19, 2022 @12:43AM (#31796227)
> once I've made an S3 endpoint in my VPC, it can be used to access any bucket. So... it seems like it could be used just as easily to exfiltrate data?

On the contrary, and that is one of the strong points of using VPC endpoints. You can whitelister the buckets that are accessible through the endpoints, which means it is in fact the only way to prevent data exfiltration.

[ Parent | on HN ]